From 3d6b9499faa45dc1fbaa0d6f5bb98f449973296d Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 4 Oct 2026 22:25:08 -0400
Subject: [PATCH 1/4] ci: repin ci-workflows to v0.38.0

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
---
 .github/workflows/pr-automerge-dependabot.yml |  2 +-
 .github/workflows/pr-require-checks.yml       | 50 +++++++++----------
 components/managed-files-guard/README.md      |  2 +-
 3 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/pr-automerge-dependabot.yml b/.github/workflows/pr-automerge-dependabot.yml
index 75207e85..5a27c2c6 100644
--- a/.github/workflows/pr-automerge-dependabot.yml
+++ b/.github/workflows/pr-automerge-dependabot.yml
@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: write # enablePullRequestAutoMerge
       pull-requests: write # enable or disable auto-merge on the PR
-    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
     with:
       # Public repository: runner-policy admits only a hosted label here.
       runner: ubuntu-24.04
diff --git a/.github/workflows/pr-require-checks.yml b/.github/workflows/pr-require-checks.yml
index 3d212e8f..6a3f9a38 100644
--- a/.github/workflows/pr-require-checks.yml
+++ b/.github/workflows/pr-require-checks.yml
@@ -107,7 +107,7 @@ jobs:
           persist-credentials: false
       - name: Lint shell
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/shellcheck@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/shellcheck@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           rcfile: .shellcheckrc
           exclude: components/shellcheck/fixtures/bad
@@ -149,7 +149,7 @@ jobs:
       # the contract tests below run on the repository's .node-version.
       - name: Lint markdown
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/markdownlint@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/markdownlint@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           config: .markdownlint-cli2.jsonc
           globs: '**/*.md !components/**/fixtures/bad/**'
@@ -173,7 +173,7 @@ jobs:
         run: bash harness/shell/run-tests.sh components/markdownlint/markdownlint-schema-pin.test.sh
       - name: Check links (offline)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/lychee-offline@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/lychee-offline@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           config: lychee.toml
           exclude: 'components/[^/]+/fixtures/bad'
@@ -222,7 +222,7 @@ jobs:
           persist-credentials: false
       - name: Self-lint repository (installs ec, excludes intentionally-bad fixtures)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           config: .editorconfig-checker.json
           exclude: 'components/[^/]+/fixtures/bad/'
@@ -231,7 +231,7 @@ jobs:
         run: bash harness/shell/run-tests.sh components/editorconfig-checker/editorconfig-checker.test.sh
       - name: Scan repository for secrets (installs gitleaks)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/gitleaks@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/gitleaks@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           config: .gitleaks.toml
       - name: Gitleaks contract test
@@ -239,7 +239,7 @@ jobs:
         run: bash harness/shell/run-tests.sh components/gitleaks/gitleaks.test.sh
       - name: Spell-check repository (installs typos, excludes intentionally-bad fixtures)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/typos@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/typos@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           config: _typos.toml
           exclude: 'components/*/fixtures/bad/'
@@ -248,10 +248,10 @@ jobs:
         run: bash harness/shell/run-tests.sh components/typos/typos.test.sh
       - name: Verify shebang files are executable
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
       - name: Check for machine-specific paths (excludes the pattern source, which self-matches)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           exclude: ':(exclude)components/path-detection/**'
       - name: Path-detection contract test
@@ -259,10 +259,10 @@ jobs:
         run: bash harness/shell/run-tests.sh components/path-detection/machine-path-patterns.test.sh
       - name: Check index-level EOL drift
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-line-endings@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/check-line-endings@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
       - name: Scan comment hygiene (excludes contract fixtures and policy source)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           exclude: ':(exclude)components/*/fixtures/bad/** :(exclude)components/comment-hygiene/**'
       - name: Comment-hygiene contract test
@@ -291,7 +291,7 @@ jobs:
           persist-credentials: false
       - name: Analyze PowerShell
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/psscriptanalyzer@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/psscriptanalyzer@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           settings: PSScriptAnalyzerSettings.psd1
           exclude: components/psscriptanalyzer/fixtures/bad
@@ -328,7 +328,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           filters: |
             lefthook:
@@ -427,7 +427,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           filters: |
             python:
@@ -452,7 +452,7 @@ jobs:
       # find the inline-installed tools first on PATH.
       - name: Lint and format-check Python
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['python'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/ruff@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/ruff@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           config: ruff.toml
           exclude: components/ruff/fixtures/bad
@@ -461,7 +461,7 @@ jobs:
         # at the conforming fixture explicitly (the bad fixture is non-conforming
         # by design).
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['python'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/pyright@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/pyright@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           config: components/pyright/pyrightconfig.json
           paths: components/pyright/fixtures/good
@@ -512,7 +512,7 @@ jobs:
         # fixtures are non-conforming by design; node_modules and locks are
         # excluded by Biome's normal traversal rules.
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/biome@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/biome@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           config: components/biome/biome.json
           paths: components/biome/fixtures/good components/concurrency-policy components/dependabot-policy components/github-actions-conventions components/mcp-launcher components/runner-policy distribution harness/packages
@@ -566,7 +566,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           filters: |
             dotnet:
@@ -622,12 +622,12 @@ jobs:
         # conforming fixture, which imports the base props (the bad fixture is
         # non-conforming by design).
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['dotnet'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/dotnet-build@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/dotnet-build@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           project: components/dotnet-analysis/fixtures/good/good.csproj
       - name: Verify .NET whitespace
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['dotnet'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/dotnet-format@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/dotnet-format@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           project: components/dotnet-analysis/fixtures/good/good.csproj
 
@@ -645,7 +645,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           filters: |
             go:
@@ -840,7 +840,7 @@ jobs:
           persist-credentials: false
       - name: Lint workflows
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/actionlint@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/actionlint@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
       - name: Test actionlint component
         if: ${{ !cancelled() }}
         run: bash harness/shell/run-tests.sh components/actionlint/actionlint.test.sh
@@ -954,7 +954,7 @@ jobs:
     # components/managed-files-guard/, which become consumers'
     # .github/workflows/ files, are invisible to a repo-root scan. They are named explicitly so the lane audits what it
     # ships.
-    uses: melodic-software/ci-workflows/.github/workflows/pr-audit-workflows.yml@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-audit-workflows.yml@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
     with:
       runner: ubuntu-24.04
       paths: . components/claude-lanes/claude-review.yml components/claude-lanes/claude-security-review.yml components/claude-lanes-hosted/claude-review.yml components/claude-lanes-hosted/claude-security-review.yml components/managed-files-guard/managed-files-guard.yml components/managed-files-guard/managed-files-guard-fleet.yml
@@ -967,7 +967,7 @@ jobs:
     # Advisory dependency vuln scan; reports against package-lock.json without
     # blocking (fail-on-vuln defaults false). Annotation mode needs no
     # security-events write grant.
-    uses: melodic-software/ci-workflows/.github/workflows/pr-scan-dependencies.yml@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-scan-dependencies.yml@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
     with:
       runner: ubuntu-24.04
 
@@ -1080,7 +1080,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check the pull-request contract
-        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           token: ${{ github.token }}
           # Carried over from the pr-issue-linkage.yml caller this step
@@ -1094,7 +1094,7 @@ jobs:
         # and the `ci-lanes` status is on the SHA for the next contract-only
         # run.
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@fb56986808750d6856c27de78df15e150027b8dc # v0.36.0
+        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
           treat-skipped-as: fail
           token: ${{ github.token }}
diff --git a/components/managed-files-guard/README.md b/components/managed-files-guard/README.md
index c475937b..e4334422 100644
--- a/components/managed-files-guard/README.md
+++ b/components/managed-files-guard/README.md
@@ -125,7 +125,7 @@ the consumer's caller still carries the old list.
 **The action pin** is a full 40-character commit SHA of ci-workflows `main`,
 under the `pin-comment-convention` (`components/pin-comment-convention/`).
 Both files pin `.github/actions/check-managed-files` at
-`fb56986808750d6856c27de78df15e150027b8dc` (v0.36.0) today. v0.34.0
+`95732fda50a95d3297320a6f2c791a1a91870a7f` (v0.38.0) today. v0.34.0
 (`7446b51`) gave the action that path; the pins below name its old path,
 `.github/actions/managed-files-guard`. The pin moves with each ci-workflows release through the cascade below.
 The earlier pins are recorded because of what they fixed:

From 1161292e93536c82dec5b3ae0ffbd3a2377fe9bf Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 4 Oct 2026 22:45:23 -0400
Subject: [PATCH 2/4] ci: pin the .NET SDK for dotnet-build and dotnet-format

ci-workflows v0.38.0 requires a dotnet-version or a caller global.json.
10.0.400 is the SDK these steps installed before, from ci-workflows' own
global.json.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/pr-require-checks.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/pr-require-checks.yml b/.github/workflows/pr-require-checks.yml
index 6a3f9a38..86c8728e 100644
--- a/.github/workflows/pr-require-checks.yml
+++ b/.github/workflows/pr-require-checks.yml
@@ -591,7 +591,7 @@ jobs:
           persist-credentials: false
       # The fixture tests run first, while DOTNET_VERSION is the only SDK in
       # DOTNET_INSTALL_DIR. The build and format actions then install the SDK
-      # they pin, which is newer, so each step runs the SDK it ran alone.
+      # passed below, which is newer, so each step runs the SDK it ran alone.
       - name: Set up .NET
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['dotnet'] != 'false' }}
         uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
@@ -624,11 +624,13 @@ jobs:
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['dotnet'] != 'false' }}
         uses: melodic-software/ci-workflows/.github/actions/dotnet-build@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
+          dotnet-version: 10.0.400
           project: components/dotnet-analysis/fixtures/good/good.csproj
       - name: Verify .NET whitespace
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['dotnet'] != 'false' }}
         uses: melodic-software/ci-workflows/.github/actions/dotnet-format@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
         with:
+          dotnet-version: 10.0.400
           project: components/dotnet-analysis/fixtures/good/good.csproj
 
   check-go:

From e3d1d8d3098ad83fa3123503298638efeee037df Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 4 Oct 2026 22:46:57 -0400
Subject: [PATCH 3/4] ci: repin ci-workflows to v0.38.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/pr-automerge-dependabot.yml |  2 +-
 .github/workflows/pr-require-checks.yml       | 50 +++++++++----------
 components/managed-files-guard/README.md      |  2 +-
 3 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/pr-automerge-dependabot.yml b/.github/workflows/pr-automerge-dependabot.yml
index 5a27c2c6..1a89c21e 100644
--- a/.github/workflows/pr-automerge-dependabot.yml
+++ b/.github/workflows/pr-automerge-dependabot.yml
@@ -20,7 +20,7 @@ jobs:
     permissions:
       contents: write # enablePullRequestAutoMerge
       pull-requests: write # enable or disable auto-merge on the PR
-    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-automerge-dependabot.yml@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
     with:
       # Public repository: runner-policy admits only a hosted label here.
       runner: ubuntu-24.04
diff --git a/.github/workflows/pr-require-checks.yml b/.github/workflows/pr-require-checks.yml
index 86c8728e..f735f760 100644
--- a/.github/workflows/pr-require-checks.yml
+++ b/.github/workflows/pr-require-checks.yml
@@ -107,7 +107,7 @@ jobs:
           persist-credentials: false
       - name: Lint shell
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/shellcheck@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/shellcheck@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           rcfile: .shellcheckrc
           exclude: components/shellcheck/fixtures/bad
@@ -149,7 +149,7 @@ jobs:
       # the contract tests below run on the repository's .node-version.
       - name: Lint markdown
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/markdownlint@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/markdownlint@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           config: .markdownlint-cli2.jsonc
           globs: '**/*.md !components/**/fixtures/bad/**'
@@ -173,7 +173,7 @@ jobs:
         run: bash harness/shell/run-tests.sh components/markdownlint/markdownlint-schema-pin.test.sh
       - name: Check links (offline)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/lychee-offline@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/lychee-offline@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           config: lychee.toml
           exclude: 'components/[^/]+/fixtures/bad'
@@ -222,7 +222,7 @@ jobs:
           persist-credentials: false
       - name: Self-lint repository (installs ec, excludes intentionally-bad fixtures)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/editorconfig-checker@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           config: .editorconfig-checker.json
           exclude: 'components/[^/]+/fixtures/bad/'
@@ -231,7 +231,7 @@ jobs:
         run: bash harness/shell/run-tests.sh components/editorconfig-checker/editorconfig-checker.test.sh
       - name: Scan repository for secrets (installs gitleaks)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/gitleaks@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/gitleaks@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           config: .gitleaks.toml
       - name: Gitleaks contract test
@@ -239,7 +239,7 @@ jobs:
         run: bash harness/shell/run-tests.sh components/gitleaks/gitleaks.test.sh
       - name: Spell-check repository (installs typos, excludes intentionally-bad fixtures)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/typos@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/typos@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           config: _typos.toml
           exclude: 'components/*/fixtures/bad/'
@@ -248,10 +248,10 @@ jobs:
         run: bash harness/shell/run-tests.sh components/typos/typos.test.sh
       - name: Verify shebang files are executable
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/check-exec-bit@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
       - name: Check for machine-specific paths (excludes the pattern source, which self-matches)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/check-machine-paths@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           exclude: ':(exclude)components/path-detection/**'
       - name: Path-detection contract test
@@ -259,10 +259,10 @@ jobs:
         run: bash harness/shell/run-tests.sh components/path-detection/machine-path-patterns.test.sh
       - name: Check index-level EOL drift
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-line-endings@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/check-line-endings@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
       - name: Scan comment hygiene (excludes contract fixtures and policy source)
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/check-comment-markers@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           exclude: ':(exclude)components/*/fixtures/bad/** :(exclude)components/comment-hygiene/**'
       - name: Comment-hygiene contract test
@@ -291,7 +291,7 @@ jobs:
           persist-credentials: false
       - name: Analyze PowerShell
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/psscriptanalyzer@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/psscriptanalyzer@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           settings: PSScriptAnalyzerSettings.psd1
           exclude: components/psscriptanalyzer/fixtures/bad
@@ -328,7 +328,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           filters: |
             lefthook:
@@ -427,7 +427,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           filters: |
             python:
@@ -452,7 +452,7 @@ jobs:
       # find the inline-installed tools first on PATH.
       - name: Lint and format-check Python
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['python'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/ruff@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/ruff@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           config: ruff.toml
           exclude: components/ruff/fixtures/bad
@@ -461,7 +461,7 @@ jobs:
         # at the conforming fixture explicitly (the bad fixture is non-conforming
         # by design).
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['python'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/pyright@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/pyright@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           config: components/pyright/pyrightconfig.json
           paths: components/pyright/fixtures/good
@@ -512,7 +512,7 @@ jobs:
         # fixtures are non-conforming by design; node_modules and locks are
         # excluded by Biome's normal traversal rules.
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/biome@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/biome@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           config: components/biome/biome.json
           paths: components/biome/fixtures/good components/concurrency-policy components/dependabot-policy components/github-actions-conventions components/mcp-launcher components/runner-policy distribution harness/packages
@@ -566,7 +566,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           filters: |
             dotnet:
@@ -622,13 +622,13 @@ jobs:
         # conforming fixture, which imports the base props (the bad fixture is
         # non-conforming by design).
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['dotnet'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/dotnet-build@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/dotnet-build@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           dotnet-version: 10.0.400
           project: components/dotnet-analysis/fixtures/good/good.csproj
       - name: Verify .NET whitespace
         if: ${{ !cancelled() && fromJSON(steps.changes.outputs.results || '{}')['dotnet'] != 'false' }}
-        uses: melodic-software/ci-workflows/.github/actions/dotnet-format@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/dotnet-format@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           dotnet-version: 10.0.400
           project: components/dotnet-analysis/fixtures/good/good.csproj
@@ -647,7 +647,7 @@ jobs:
     steps:
       - name: Detect relevant changes
         id: changes
-        uses: melodic-software/ci-workflows/.github/actions/detect-changes@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/detect-changes@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           filters: |
             go:
@@ -842,7 +842,7 @@ jobs:
           persist-credentials: false
       - name: Lint workflows
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/actionlint@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/actionlint@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
       - name: Test actionlint component
         if: ${{ !cancelled() }}
         run: bash harness/shell/run-tests.sh components/actionlint/actionlint.test.sh
@@ -956,7 +956,7 @@ jobs:
     # components/managed-files-guard/, which become consumers'
     # .github/workflows/ files, are invisible to a repo-root scan. They are named explicitly so the lane audits what it
     # ships.
-    uses: melodic-software/ci-workflows/.github/workflows/pr-audit-workflows.yml@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-audit-workflows.yml@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
     with:
       runner: ubuntu-24.04
       paths: . components/claude-lanes/claude-review.yml components/claude-lanes/claude-security-review.yml components/claude-lanes-hosted/claude-review.yml components/claude-lanes-hosted/claude-security-review.yml components/managed-files-guard/managed-files-guard.yml components/managed-files-guard/managed-files-guard-fleet.yml
@@ -969,7 +969,7 @@ jobs:
     # Advisory dependency vuln scan; reports against package-lock.json without
     # blocking (fail-on-vuln defaults false). Annotation mode needs no
     # security-events write grant.
-    uses: melodic-software/ci-workflows/.github/workflows/pr-scan-dependencies.yml@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+    uses: melodic-software/ci-workflows/.github/workflows/pr-scan-dependencies.yml@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
     with:
       runner: ubuntu-24.04
 
@@ -1082,7 +1082,7 @@ jobs:
     timeout-minutes: 15
     steps:
       - name: Check the pull-request contract
-        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/check-contract@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           token: ${{ github.token }}
           # Carried over from the pr-issue-linkage.yml caller this step
@@ -1096,7 +1096,7 @@ jobs:
         # and the `ci-lanes` status is on the SHA for the next contract-only
         # run.
         if: ${{ !cancelled() }}
-        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@95732fda50a95d3297320a6f2c791a1a91870a7f # v0.38.0
+        uses: melodic-software/ci-workflows/.github/actions/pr-require-checks/aggregate-results@2531d56a21e79b7b5222643fadbee95c23a4525b # v0.38.1
         with:
           treat-skipped-as: fail
           token: ${{ github.token }}
diff --git a/components/managed-files-guard/README.md b/components/managed-files-guard/README.md
index e4334422..cc1cc432 100644
--- a/components/managed-files-guard/README.md
+++ b/components/managed-files-guard/README.md
@@ -125,7 +125,7 @@ the consumer's caller still carries the old list.
 **The action pin** is a full 40-character commit SHA of ci-workflows `main`,
 under the `pin-comment-convention` (`components/pin-comment-convention/`).
 Both files pin `.github/actions/check-managed-files` at
-`95732fda50a95d3297320a6f2c791a1a91870a7f` (v0.38.0) today. v0.34.0
+`2531d56a21e79b7b5222643fadbee95c23a4525b` (v0.38.0) today. v0.34.0
 (`7446b51`) gave the action that path; the pins below name its old path,
 `.github/actions/managed-files-guard`. The pin moves with each ci-workflows release through the cascade below.
 The earlier pins are recorded because of what they fixed:

From 8f85022295972d8af8237482e9f6dec3e057a673 Mon Sep 17 00:00:00 2001
From: Kyle Sexton <153232337+kyle-sexton@users.noreply.github.com>
Date: Sun, 4 Oct 2026 23:05:19 -0400
Subject: [PATCH 4/4] docs(managed-files-guard): label the documented action
 pin v0.38.1

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 components/managed-files-guard/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/components/managed-files-guard/README.md b/components/managed-files-guard/README.md
index cc1cc432..de681ad7 100644
--- a/components/managed-files-guard/README.md
+++ b/components/managed-files-guard/README.md
@@ -125,7 +125,7 @@ the consumer's caller still carries the old list.
 **The action pin** is a full 40-character commit SHA of ci-workflows `main`,
 under the `pin-comment-convention` (`components/pin-comment-convention/`).
 Both files pin `.github/actions/check-managed-files` at
-`2531d56a21e79b7b5222643fadbee95c23a4525b` (v0.38.0) today. v0.34.0
+`2531d56a21e79b7b5222643fadbee95c23a4525b` (v0.38.1) today. v0.34.0
 (`7446b51`) gave the action that path; the pins below name its old path,
 `.github/actions/managed-files-guard`. The pin moves with each ci-workflows release through the cascade below.
 The earlier pins are recorded because of what they fixed: